Deploy with confidence. Stay in control.
Set the rules your services have to follow. Axiom checks every deploy against them, and stops the ones that break them.
- Free for one project
- Nothing to install
- Works with your pipeline
Services
- checkout-api
- payments-worker
- ledger
- identity
- notifications
- search-index
Latest deploy
#8f2c41d
2 minutes ago · 40ms
no public storage 8ms
traffic is encrypted 11ms
every service has an owner 6ms
secrets rotated in 90 days 9ms
minimum TLS version 2 services
deploy stopped · 1 rule broken
Coverage
- Services
- 37
- Protected
- 34
- Rules
- 9
- Checks today
- 1,284
- Stopped today
- 3
Trusted in production at
- Northbound
- Kestrel
- Meridian Health
- Ledgerworks
- Vantage Grid
- Pallas
Write a rule once. It runs on every deploy.
A rule is a few plain lines that live next to the service they protect. Axiom reads them and checks them against everything you run.
Ledgerworks protects 412 storage buckets across six accounts, with nine rules.
rules/storage.axiom
- 1 rule "no public storage" {
- 2 when resource is "storage bucket"
- 3 require access is not "public"
- 4 require encrypted
- 5
- 6 owner team:platform
- 7 since 2026-03-14
- 8 }
- 9
- 10 # 412 buckets checked, all pass
A deploy that breaks a rule doesn’t go out.
Axiom runs as a required check in your pipeline. It reads what is about to change, checks the rules that apply, and answers before anything ships.
Kestrel stopped 118 deploys last quarter and shipped 9,400 that passed.
In your pipeline
axiom check --env production
no public storage 412 buckets
every service has an owner 37 services
traffic is encrypted 37 services
secrets rotated in 90 days 88 secrets
minimum TLS version is 1.3 2 services
checkout-api, payments-worker 40ms
deploy stopped · 1 rule broken
See what’s protected, and what isn’t.
Most teams cannot answer that. Axiom keeps a live list of every service and environment, so the gaps are a row you can point at.
Meridian Health protected 37 services in eleven days.
Reporting
| Service | Prod | Staging | Dev | Owner |
|---|---|---|---|---|
| checkout-api | ✓ | ✓ | ✓ | team:payments |
| payments-worker | ✓ | ✓ | — | team:payments |
| ledger | ✓ | ✓ | ✓ | team:core |
| identity | ✓ | — | — | team:platform |
| search-index | — | — | — | unassigned |
| notifications | ✓ | ✓ | ✓ | team:growth |
Recently shipped
All releasesrules/traffic.axiom
rule "traffic is encrypted" {
when resource is "load balancer"
- require tls is at least "1.2"
+ require tls is at least "1.3"
+ grace 30 days
owner team:platform
}
2 services would newly stop:
checkout-api tls 1.2
payments-worker tls 1.2
grace ends 4 October
reviewed by rk, ade
Rule changes
Every change to a rule arrives as a diff, showing the services it would newly stop.
deploy 8f2c41d
when 4 Sept, 14:22
commit a91f3ee
checked 142 rules
passed 141
failed 1
by ada@kestrel.io
History
A record of every check that ran, ready to export whenever someone asks.
checked 06:00 · 412 resources
storage made public by hand
put back, owner told
Change alerts
Someone changes something by hand, and you hear about it in minutes.
Start with one rule
Install the CLI, write the rule you already argue about in review, and see what it catches.